GitHub Advisoryadvisory · PyPI

GHSA-jhhc-3hcp-qhm5 WeasyPrint has CSS Injection via Presentational Hints

MEDIUM Published 2026-07-06 Modified 2026-07-06 Official page ↗
Aliases
CVE-2026-49452
Ecosystem
PyPI
Packages
weasyprint
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-74
Reviewed
2026-07-06

Affected packages

• PyPI weasyprint: <= 68.1 (no fix yet)

Description

Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input. Details File: weasyprint/css/__init__.py The `background` attribute is used to construct CSS: background-image:url({element.get("background")}) This string is parsed by `tinycss2.parse_blocks_contents()`. Because the value is not escaped, additional CSS declarations can be injected. PoC Impact • CSS injection • Server-side requests via injected `url()` • Limited to cases where `presentational_hints=True` Suggested Fix • Escape attribute values before embedding into CSS • Restrict allowed values for presentational hints VULN-05_css_injection_presentational_hints.md

Related

Alias · CVE (1)

  • CVE-2026-49452 WeasyPrint helps web developers to create PDF documents. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References